How does the CampaignMember object work in terms of record visibility?

Question

I am trying to understand how the CampaignMember object behaves in terms of security.

According to the Salesforce documentation, in order for a user to view a CampaignMember record the user must have access to the Campaign record and the Contact/Lead record associated with the campaign member in question. In addition, the user must have the 'Marketing User' checkbox enabled in the user detail.

I am working on a custom LWC that displays the campaign members of a campaign in a Datatable. The table has different columns, where data of the campaign member itself is shown as well as data related to the contact associated to it.

In order to load the campaign members in this table, there is a controller Apex class that is in charge of retrieving these records. This class contains the keyword 'with sharing' so that the sharing rules are applied.

I am having a behavior that I did not expect because users can view all the campaign members associated to a campaign, even though these users only have access to the campaign and not to the contact/lead associated to the campaign member.

The sharing rules seem to be applied correctly since when a campaign member associated to a contact/lead is loaded, if the user does not have access to the contact/lead, the columns that are filled with the contact's/lead's information appear empty. They appear empty because the user does not have access to the contact/lead record.

Am I missing something?

Answer 1

In the initial post I did not clarify that the LWC was being built to integrate into an Experience Cloud page (although I think this is not relevant).

As I discussed in the previous comment, according to the Salesforce documentation, there are several requirements that have to be met for Campaign Members to be visible to a user.

• Campaign Members - User permission needed

• To View a Campaign Member

Apparently, these requirements do not always have to be met. The behaivour that I have observed is as follows:

1. If Organisation Wide Sharing Setting for Campaign Members are set to "Controlled By Campaigns", all Campaign Members are visible to users who can access the related Campaign.

2. If Organization Wide Sharing Setting for Campaign Members are set to "Controlled By Campaign Members", only the Campaign Members whose related Contact/Lead is visible to the user will be visible.

This same behavior is described by Eric Van Horssen in a Trailblazer Community post in the Architects Trailblazers group. As he indicates in his answer, the documentation does not talk about 'Controlled by Campaign Member' which has been active since Summer 18 release.

IMPORTANT NOTE

In the first scenario, where all Campaign Members related to a Campaign are visible, if the user does not have visibility on the Contact/Lead related to the Campaign Member, this user will not be able to see this record.

If the user, who sees the Campaign Member but not its related Contact/Lead, the ContactId field of the Campaign Member will return null.

This last behavior can take advantage of it. How?

Let's imagine that we need to build a custom component that shows only those Campaign Members related to the Contact/Lead that a user has access to, but we can't stablish "Controlled By Campaign Members" as the Organization Wide Sharing Setting for Campaign Members.

Some alternatives we would have, as long as the Apex class includes in its definition the keyword "with sharing":

• In the SOQL query that will be used to retrieve the Campaign Members, apply a filter to retrieve only those Campaign Members whose ContactId is different from null. Using the '!=' filter in SOQL queries has some implications, review this Salesforce blog post.
• Retrieve all Campaign Members (do not apply any filter in the SOQL related to the ContactId field). Loop the list of Campaign Members and discard those Campaign Members that have the ContactId field null (it will be necessary to retrieve the field in the SOQL query).

SECOND IMPORTANT NOTE

Since the Summer 21 release, a feature can be activated in Salesforce to add accounts as Campaign Members. The scenarios described in points 1 and 2 behave in the same way at the visibility level for these Campaign Members.

For Campaign Members that relate to Accounts instead Contact/Lead, the field AccountId is used to establish the relationship. This field will always be populated, even though the user who has visibility on the Campaign Member does not see the related Account. Therefore, what is described in the IMPORTANT NOTE section would not be applicable for this type of Campaign Members.